Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representatio...
First reported Oct 07, 2026 20:46 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune ar...
First reported Oct 07, 2026 18:29 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordIn Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a...
First reported Oct 07, 2026 20:46 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation befor...
First reported Oct 07, 2026 17:45 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordIn Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve original source code for the Discover Sp...
First reported Oct 07, 2026 20:46 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordpgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for ex...
First reported Oct 07, 2026 23:03 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordInsertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which f...
First reported Oct 07, 2026 18:46 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordIn Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to w...
First reported Oct 07, 2026 20:46 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordIn affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted t...
First reported Oct 08, 2026 01:38 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordA command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted inpu...
First reported Oct 08, 2026 00:51 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordCVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60. Unauthenticated attackers can send specially crafted traffic to the server and...
First reported Oct 07, 2026 19:41 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordCVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of ser...
First reported Oct 07, 2026 19:54 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordIn Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw co...
First reported Oct 07, 2026 20:46 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Di...
First reported Oct 07, 2026 21:24 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordIn Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could cause an affected Linux packa...
First reported Oct 07, 2026 20:46 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordIn Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound request from Splunk App for Splunk Observa...
First reported Oct 07, 2026 20:46 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordVault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an A...
First reported Oct 07, 2026 21:21 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordIn Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries into the app log through the Representati...
First reported Oct 07, 2026 20:46 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordGitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authe...
First reported Oct 07, 2026 20:05 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then ...
First reported Oct 07, 2026 18:37 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordIn Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface (API) tool to the URL ...
First reported Oct 07, 2026 20:46 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordA flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespace openshift-config grants get, list, and watch permissions on all Secret resources without resou...
First reported Oct 07, 2026 19:29 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Dom...
First reported Oct 07, 2026 21:15 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordtraverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a prim...
First reported Oct 07, 2026 19:35 UTCCatalog metadata updated Oct 08, 2026 03:43 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.